ML20135G982
| ML20135G982 | |
| Person / Time | |
|---|---|
| Site: | North Anna  |
| Issue date: | 05/14/2020 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Littlejohn J (301) 415-0428 | |
| References | |
| LER 1993-002-00 | |
| Download: ML20135G982 (6) | |
Text
A.8-1 A. 8 LER No. 339/93-002 Event
Description:
Auxiliary Feedwater Disabled After Reactor Trip Date of Event: April 16, 1993 Plant: North Anna 2 A. 8.1 Summary North Anna 2 was operating at 100% power on April 16, 1993, when a malfunction in the main generator voltage regulator circuitry caused a turbine trip, which resulted in a reactor trip. Following the reactor trip, the auxiliary feedwater (AFW) pumps started on low-low steam generator (SG) level. During subsequent recovery actions the AFW pumps were disabled by placing the control switches in a "pull-to- lock" position before restoring SIG levels above the automatic start set point, defeating the automatic start capability of the AFW pumps. The conditional core damage probability estimated for this event is 1. 1 x 10-6. The relative significance of this event compared to other postulated events at North Anna 2 is shown in Fig. A. 8. 1.
LER 339/93-002 1E-7 I E-6 1 1E-5 1E-4 1E-3 1E-2 L L AFW I30 TRIPLOFW & L - 360 h EP L.-- Precursor Cutoff AFW 1MVTR LO Fig. A. 8. 1 Relative event significance of LER 339/93-002 compared with other potential events at North Anna 2 A. 8.2 Event Description On April 16, 1993, with North Anna 2 at 100% power, an automatic reactor trip occurred from a turbine trip due to a malfunction in the main generator voltage regulator circuitry The AFW pumps automatically started on low-low SG level. During the subsequent recovery actions of the reactor trip response procedure, it was noted that the reactor coolant system (RCS) was experiencing a cooldown due to feeding the SGs with relatively cold water from the AFW system. The operating crew became concerned with the RCS cooldown rate when RCS temperature decreased to -5400'F. The operator requested permission to secure AFW and to reset the ATWS Mitigation System Actuation Circuitry (AMSAC). The applicability of procedural steps used to control an excessive cooldown at this point was unclear. The first step in the procedure addressed the response to an excessive cooldown. However, the crew was currently at step 6. It was unclear if step 1 applied at this point. The Unit 2 supervisor, who was not involved in reading the procedure, requested the operator to secure AFW As a result, the operator opened two of the main feedwater (MFW) bypass valves to establish flow to the SGs and then stopped the AFW pumps by placing the motor-driven AFW (MDAFW) pumps in pull-to-lock position and closing the two supply valves to the turbine-driven AFW (TDAFW) pump. Approximately 19 min after AFW was secured, the AFW pumps were returned to the AUTO position. At this point, SG levels had risen above 20%, and the pump automatic start signal at 18% had cleared.
LER No. 339/93-002
A.8-2 A. 8.3 Additional Event-Related Information North Anna 2 is equipped with three safety-related AFW pumps. One pump is powered by a steam turbine, and the other two are motor-driven and powered from redundant 4. 16-ky emergency buses. The full-capacity TDAFW pump is rated at 735 gal/mmn and each half-capacity MDAFW pump is rated at 370 gal/min. All three pumps are connected to two main headers. Either header may supply any of the three SGs but the headers are normally al igned so that one carries flow to a particular SG. A third header provides a flow path from the TDAFW pump to the "A" SG. This third header provides the flexibility required to dedicate a pump to each SG.
MFW isolates when Tave = 5400 F (LOW-LOW Tave). This isolation prevents the MFW regulating valves from opening until the reactor trip breakers have been reset; however, makeup for the SGs is available through the MFW regulating bypass valves. This bypass function requires that the bypass valves be manually opened by the plant operators.
In this event, the operator disabled the AFW pumps from an auto start signal on SG low-low level by using the pull-to-lock position for the MDAFW pumps and closing the steam valves for the TDAFW pump. The first step of procedure 2-ES-0. 1, Reactor Trip Response, checks for expected RC S temperatures. If the temperature is less than desired (547'F) and trending down, then AFW flow should be adjusted to 400 gal/mmn until at least one SG level is greater than 11%. Step 2 of the procedure has the operator check for sufficient feedwater flow. If adequate flow is not available, the operator is directed to establish AFW or MFW No direction was provided for shutting down the AFW system and placing MFW into service. When the decision was made to secure AFW and use MFW, the task was accomplished without procedural guidance.
A. 8.4 Modeling Assumptions The AFW pumps did start automatically as required following the trip; however, the automatic capability of the system was disabled when the pumps were secured. This event was analyzed because it met the ASP precursor criteria as a reactor trip with a safety system disabled. AFW was considered disabled because manual actions would be required to restore the AFW system to operation.
This event was modeled as a reactor trip with a loss of all AFW, It was assumed that the operator would not have terminated AFW if MFW had not operated. Therefore, the failure rate for MFW was modified to be consistent with a transient with MFW initially available. The North Anna individual plant examination provides a value of 3.24 x 10-3 for this probability. The nonrecovery probability for the MFW system was left at the default value of 0.34. This assumes that failures of the MFW system following termination of AFW are recoverable in the required time period. The AFW pumps were modeled as unavailable due to the operator placing the control switches in the pull-to-lock position. A nonrecovery probability of 0.04 (ASP recovery class R4, NUREG/CR-4674, Vol. 17, Appendix A, Sect. A. 1.3) was assumed for the AFW pumps because the pumps could have been restarted from the control room.
A. 8.5 Analysis Results The conditional probability of subsequent core damage estimated for this event is 1.1 x 10-6. The dominant core damage sequences, highlighted on the event tree in Fig. A. 8.2, involve failure of all sources of SG makeup and failure of feed-and-bleed cooling. In all sequences both AFW and MFW fail. Feed-and-bleed fails for different reasons in the two dominant sequences. In sequence 17, feed-and-bleed fails when either the high-pressure injection system fails or the operator fails to initiate feed-and-bleed; In sequence 15, LER No. 339/93-002
A.8-3 high-pressure injection is successful, but the pressurizer power-operated relief valve fails to open, resulting in failure of feed-and-bleed.
LER No. 339/93-002
A.8-4 PORVI 01 POVORV SEO END TRANS RT SRV SRy HPI -l*P CSR I OPEN CHAL jRESEAT NO STATE OK OK 20 CD 11 CD 12 CD OK OK OK 21 CO 13 CD 14 CD OK OK 22 CD 1S CD 16 CD 17 CD Is ATWS Fig. A. 8.2 Dominant core damage sequence for LER 339/93-002 LER No. 339/93-002
A.8-5 CONDITIONAL CORE DAMAGE PROBABILITY CALCULATIONS Event identifier: 339/93- 002 Event
Description:
AFW Disabled After Plant Trip Event Date: 06/16/-93 Plant: North Anna 2 INITIATING EVENT NONRECOVERABLE INITIATING EVENT PROBABILITIES TRANS 1.OE+OO SEQUENCE CONDITIONAL PROBABILITY SUMS End State/Initiator Probabi Lity CD TRANS 1.1E -06 Total 1.1E-06 ATWS TRANS 3.4E-05 Total 3.4E-05 SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER)
Sequence End State Prob N Rec**
17 trans -rt AFW MFW hpi(f/b) CD 4.9E-07 1.1E-02 15 trans -rt AFW MFW -hpi(f/b) -hpr/-hpi porv.open CD 4.5E-07 1.4E-02 16 trans -rt AFW MFW -hpi(f/b) hpr/-hpi CD 4.9E-08 1.4E-02 22 trans -rt AFW MFW -hpi(f/b) -hpr/-hpi -porv.open csr CD 4.6E-08 1.4E-02 12 trans -rt -AFW porv.or.srv.chall porv.or.srv.reseat hpi CD 1.6E-08 8.9E-03 18 trans rt ATWS 3.4E-05 1.2E-01
- nonrecovery credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDER)
Sequence End State Prob N Rec**
12 trans -rt -AFW porv.or.srv.chall porv.or.srv.reseat hpi CD 1.6E-08 8 .9E -03 22 trans -rt AFW MFW -hpi(f/b) -hpr/-hpi -porv.open csr CD 4.6E-08 1.4E-02 15 trans -rt AFW MFW -hpi(f/b) -hpr/-hpi porv.open CD 4.5E -07 1 .4E-02 16 trans -rt AFW MFW -hpi(f/b) hpr/-hpi CD 4.9E-08 1 .4E-02 17 trans -rt AFW MFW hpi(f/b) CD 4.9E-07 1.1E-02 18 trans rt ATWS 3. 4E-05 1.2E-01
- nonrecovery credit for edited case SEQUENCE MODEL: s: \asp\prog\models\pwraseal .cmp BRANCH MODEL: s:\asp\prog\modeis\northan2.sI1 PROBABILITY FILE: s: \asp\prog\modetLs\pwr bs 11.pro No Recovery Limit BRANCH FREQUENCIES/PROBABILITIES Branch System Nonrecov Opr Fai L trans 1.9E-05 1.OE+OO Loop 1.6E-05 5.3E-01 loca 2.4E-06 4.3E-01 rt 2.8E-04 1.2E-01 LER No. 339/93-002
A.8-6 rt/ Loop 0.OE+00 1.0E+00 emerg .power 2.9E-03 8.OE-01 AFW 3.8E-04 > 1.OE+00 2.6E-01 > 4.OE-02 Branch Model: 1.0F.3+ser Train 1 Cond Prob: 2.OE-02 > Failed Train 2 Cond Prob: 1.0E-01 > Failed Train 3 Cond Prob: 5.OE-02 > Failed Serial Component Prob: 2.8E-04, afw/emerg .power 5.OE-02 3.4E-01 MFW 1.9E-01 > 3.2E-03
- 3.4E-01 Branch Model: 1.OF.1 Train 1 Cond Prob: 1.9E-01 porv.or.srv.chaL I 4.0E-02 1.OE+00 porv.or.srv. reseat 3.OE-02 1.1E-02 porv.or.srv. reseat/emerg.power 3.0E-02 1.OE+00 seat. loca 2.7E-01 1.OE+00 ep.rec(sL) 5.7E-01 1.0E+00 ep. rec 7.OE-02 1.0E+00 hpi 1.5E-03 8.4E-01 hpi(flb) 1.5E-03 8.4E-01 1.OE-02 porv. open 1.0E-02 1.OE+00 4.0E-04 hpr/-hpi 1.5E-04 1.0E+00 1 O0E-03 csr 9.3E-05 1.OE+00
- branch model file
- forced LER No. 339/93-002